[PATCH v16 30/33] hw/s390x/ipl: Handle secure boot with multiple boot devices
The current approach to enable secure boot relies on providing
secure-boot and boot-certs parameters of s390-ccw-virtio machine
type option, which apply to all boot devices.
With the possibility of multiple boot devices, secure boot expects all
provided devices to be supported and eligible (e.g.,
virtio-blk/virtio-scsi using the SCSI scheme).
If multiple boot devices are provided and include an unsupported (e.g.,
ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will
terminate with an error logged to the console.
Signed-off-by: Zhuoying Cai
Reviewed-by: Thomas Huth
Reviewed-by: Matthew Rosato
---
hw/s390x/ipl.c | 40 ++--
pc-bios/s390-ccw/main.c | 3 ---
2 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 35bdfe03d8..d59ed36c78 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -504,6 +504,37 @@ static void s390_set_secure_boot_flags(IplParameterBlock
*iplb,
iplb->len = cpu_to_be32(S390_IPLB_MAX_LEN);
}
+static bool s390_validate_secure_boot_device(int devtype, Error **errp)
+{
+switch (devtype) {
+case CCW_DEVTYPE_VFIO:
+error_setg(errp, "Passthrough (vfio) CCW device does not support
secure boot!");
+return false;
+case CCW_DEVTYPE_VIRTIO_NET:
+error_setg(errp, "Virtio net boot device does not support secure
boot!");
+return false;
+default:
+return true;
+}
+}
+
+static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype,
+ bool secure_boot, bool audit_mode)
+{
+Error *local_error = NULL;
+
+if (!secure_boot && !audit_mode) {
+return;
+}
+
+if (!s390_validate_secure_boot_device(devtype, &local_error)) {
+error_report_err(local_error);
+exit(1);
+}
+
+s390_set_secure_boot_flags(iplb, secure_boot, audit_mode);
+}
+
static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
{
CcwDevice *ccw_dev = NULL;
@@ -560,14 +591,19 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
iplb->flags |= DIAG308_FLAGS_LP_VALID;
-s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(),
- s390_has_certificate());
+s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
+ s390_has_certificate());
return true;
}
pbdev = s390_get_pci_device(dev_st, &devtype);
if (pbdev) {
+if (s390_secure_boot_enabled() || s390_has_certificate()) {
+error_report("Virtio pci boot device does not support secure
boot!");
+exit(1);
+}
+
pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm",
NULL);
if (pci_lp && strlen(pci_lp) > 0) {
lp = pci_lp;
diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index c5c093534c..8fc1cbf653 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -308,9 +308,6 @@ static void ipl_ccw_device(void)
switch (cutype) {
case CU_TYPE_DASD_3990:
case CU_TYPE_DASD_2107:
-IPL_assert((boot_mode == ZIPL_BOOT_MODE_NORMAL),
-"Passthrough (vfio) CCW device does not support secure
boot!");
-
dasd_ipl(blk_schid, cutype);
break;
case CU_TYPE_VIRTIO:
--
2.54.0
[PATCH v16 30/33] hw/s390x/ipl: Handle secure boot with multiple boot devices
The current approach to enable secure boot relies on providing
secure-boot and boot-certs parameters of s390-ccw-virtio machine
type option, which apply to all boot devices.
With the possibility of multiple boot devices, secure boot expects all
provided devices to be supported and eligible (e.g.,
virtio-blk/virtio-scsi using the SCSI scheme).
If multiple boot devices are provided and include an unsupported (e.g.,
ECKD, VFIO) or a non-eligible (e.g., Net) device, the boot process will
terminate with an error logged to the console.
Signed-off-by: Zhuoying Cai
Reviewed-by: Thomas Huth
Reviewed-by: Matthew Rosato
---
hw/s390x/ipl.c | 40 ++--
pc-bios/s390-ccw/main.c | 3 ---
2 files changed, 38 insertions(+), 5 deletions(-)
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 35bdfe03d8..d59ed36c78 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -504,6 +504,37 @@ static void s390_set_secure_boot_flags(IplParameterBlock
*iplb,
iplb->len = cpu_to_be32(S390_IPLB_MAX_LEN);
}
+static bool s390_validate_secure_boot_device(int devtype, Error **errp)
+{
+switch (devtype) {
+case CCW_DEVTYPE_VFIO:
+error_setg(errp, "Passthrough (vfio) CCW device does not support
secure boot!");
+return false;
+case CCW_DEVTYPE_VIRTIO_NET:
+error_setg(errp, "Virtio net boot device does not support secure
boot!");
+return false;
+default:
+return true;
+}
+}
+
+static void s390_apply_secure_boot(IplParameterBlock *iplb, int devtype,
+ bool secure_boot, bool audit_mode)
+{
+Error *local_error = NULL;
+
+if (!secure_boot && !audit_mode) {
+return;
+}
+
+if (!s390_validate_secure_boot_device(devtype, &local_error)) {
+error_report_err(local_error);
+exit(1);
+}
+
+s390_set_secure_boot_flags(iplb, secure_boot, audit_mode);
+}
+
static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
{
CcwDevice *ccw_dev = NULL;
@@ -560,14 +591,19 @@ static bool s390_build_iplb(DeviceState *dev_st,
IplParameterBlock *iplb)
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
iplb->flags |= DIAG308_FLAGS_LP_VALID;
-s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(),
- s390_has_certificate());
+s390_apply_secure_boot(iplb, devtype, s390_secure_boot_enabled(),
+ s390_has_certificate());
return true;
}
pbdev = s390_get_pci_device(dev_st, &devtype);
if (pbdev) {
+if (s390_secure_boot_enabled() || s390_has_certificate()) {
+error_report("Virtio pci boot device does not support secure
boot!");
+exit(1);
+}
+
pci_lp = object_property_get_str(OBJECT(pbdev->pdev), "loadparm",
NULL);
if (pci_lp && strlen(pci_lp) > 0) {
lp = pci_lp;
diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index c5c093534c..8fc1cbf653 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -308,9 +308,6 @@ static void ipl_ccw_device(void)
switch (cutype) {
case CU_TYPE_DASD_3990:
case CU_TYPE_DASD_2107:
-IPL_assert((boot_mode == ZIPL_BOOT_MODE_NORMAL),
-"Passthrough (vfio) CCW device does not support secure
boot!");
-
dasd_ipl(blk_schid, cutype);
break;
case CU_TYPE_VIRTIO:
--
2.54.0
